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(54) Alarm systems 



may request a display of all alarms 
present in a particular group. 



(57) An alarm system includes a 
computer 20 arranged to analyse 
various alarm conditions of appa- 
ratus (e.g. a nuclear power plant) to 
determine which alarms result from 
the prime causes of a number of 
alarms which may be present. The 
prime cause alarms are displayed 
on a visual display unit 32 and the 
presence of subsidiary alarms is in- 
dicated by group alarm lamp on a 
group alarm panel 34. The operator 
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SPECIFICATION 

Alarm systems 

5 The present invention relates to alarm systems 
and in particular but not exclusively to such 
systems for use in nuclear power stations. 

With large and complicated engineering in- 
stallations the number of alarms which may 

10 be present, at anyone time may easily over- 
whelm an operator responsible for such an 
installation. 

In trying to find the cause of, say, a particu- 
lar motor bearing running hot it is possible for 

1 5 the operator to overlook some major cause of 
the bearing running hot such as a coolant 
failure due to a pump fault. 

To assist operators with analysing the kind 
of alarm just described "alarm tree systems" 

20 have been developed wherein each alarm is 
examined by a computer and categorised as a 
'prime' cause or a minor alarm. Such systems 
may then identify the prime cause to the 
operator showing either listed with the prime 

25 cause or separately, the other alarms stemm- 
ing from the prime cause. 

It will be appreciated that an alarm, in one 
case, may be resilient from some higher order 
alarm whilst on another occassion may be a 

30 prime cause in itself. 

Developing an "alarm tree' system for ma- 
chinery of any kind is a straightforward opera- 
tion although possibly time consuming if the 
alarm arrangements are complex. However 

35 implementing such a scheme by computer 
without careful consideration of its implemen- 
tation may result in such frequent accessing 
of backing store information as to slow the 
processing function of the computer to the 

40 extent that alarm presentation is delayed. 

It is one object of the present invention to 
provide an alarm system in which the disad- 
vantages of mass presentation of alarms are 
substantially reduced. 

45 According to the present invention an alarm 
system comprises a computer, first display 
means for displaying prime cause alarm infor- 
mation, further display means for displaying 
subsidiary alarms which are dependant upon 

50 at least one associated alarm displayed on the 
first display means, the status of each condi- 
tion being monitored by the computer being 
presented at an input of the computer in 
digital form and being read by the computer 

55 at periodic intervals, the computer having at 
least one data word for each of the conditions 
being monitored and being arranged at each 
reading of a condition to compare the current 
status of said condition with the previous 

60 status of the condition as indicated by its 
respective stored data to determine when a 
change of status of the condition occurs and if 
the change of status indicates that the condi- 
tion is an alarm to determine to which one of 

65 n groups of alarms the alarm belongs, and to 



activate a respective one of n warning means 
of the further display means associated with 
the particular group of alarms the computer 
also being arranged periodically to consider 

70 each alarm with respect to any other alarms 
to determine whether the alarm is a prime 
cause or is an alarm resulting from another - 
cause to display each said prime cause alarm 
on the first display means. 

75 Preferably the first display means is a visual 
display unit and each prime cause alarm is 
displayed as a phrase or sentence thereon. 

Each display of a prime cause alarm may 
also include a reference to a plant operating 

80 manual for advice on checks which should be 
carried out or may include a suggested course 
of action. 

A prime cause alarm may be generated by 
the computer and displayed on the visual 
85 display unit if a number of alarms are present 
which are not related to a specifically moni- 
tored condition. 

An embodiment of an alarm system in ac- 
cordance with the invention will now be de- 
90 scribed with reference to the accompanying 
drawings of which:- 

Figure 1 shows a simple alarm tree. 

Figure 2 is a block schematic of an alarm 
system in accordance with the invention, 
95 Figure 3 is a schematic showing how Figs 4 
and 5 should be assembled, and 

Figures 4 and 5 show a part of a typical 
alarm tree for a power station. 

Referring first to Fig. 1 the alarm tree 
1 00 shown is a simple tree for a feed pump oil 

system to show how to develop an alarm tree. 

If for example the machinery being moni- 
tored has four bearings then a monitored 
condition may be the bearing temperature. If * 
1 05 any of the bearings runs hot then the alarm 
condition bearing temperature N high, 1 to 4, 
will be generated. 

The bearing temperature being high may 
result from oil flow to the bearing being 
110 interrupted or the flow of coolant to the 

bearing being interrupted, these giving rise to 
respective alarms oil flow TV stopped 5 to 8 or 
coolant flow N stopped 9 to 12. 

The oil flow interruption may be due to the 
1 1 5 oil pump being stopped which may give rise 
to an oil pump stopped alarm 1 3. Similarly 
coolant flow interruption may be due to a 
coolant pump failure which may give rise to a 
coolant pump stopped alarm 14. The pump 
120 stopped alarms 13 and 14 may arise if their 
respective power supplies are interrupted to 
give rise to respective alarms of oil pump 
power fail 1 5 and coolant pump power fail 
16, 

1 25 If both power fail alarms 1 5 and 1 6 are 
present a computer monitoring the system 
may generate a synthetic alarm of main power 
fail 17. 

The action of the computer in analysing the 
1 30 alarms arising will now be considered. 
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If one of the bearings is running with tem- 
perature high then one of the alarms, say 
"bearing 2 temperature high" 2 will be pre- 
sent. If none of the higher order alarms for 
5 example "oil flow stopped" 6 or "coolant 
pump stopped" 14 are present then the com- 
puter is arranged to display the message 
"Bearing 2 temperature high" on a visual 
display unit for prime cause alarms. 

10 However if say the alarm "oil flow 2 

stopped" 6 is present then "bearing 2 tem- 
perature high" 2 may be assumed to stem 
from the higher order fault. The computer 
therefore displays the message "Oil flow 2 

1 5 stopped" as the prime cause on the visual 
display unit and treats the other alarm as 
subsidiary. 

If now all of the "bearing temperature N 
high" alarms 1 to 4 are present with no 

20 higher order cause then the computer may 
display all four alarms as prime causes on the 
visual display unit and at the same time 
produce a synthetic alarm of say "oil filter 
dirty" 1 8. Alternatively the "oil filter dirty" 

25 alarm may be displayed as prime cause and 
the bearing N temperature high alarms treated 
as subsidiary alarms. 

Possible synthetic alarms are indicated in 
the diagram by broken line interconnections. 

30 It will be appreciated that the simplified 
alarm tree of Fig. 1 has been described to 
enable the reader to understand the basic 
method of determining the prime cause order 
of an alarm tree. 

35 Referring now to Fig. 2 the alarm system 
comprises a computer 20 having a number of 
alarm condition monitoring devices (not 
shown) connected thereto by way of interface 
circuits 21 to 2n. 

40 The computer 20 has access to fast access 
storage 40 and backing storage 30 which 
may be a disc store for example. The outputs 
of the computer are connected to an opera- 
tor's console 31 which includes a visual dis- 

45 play unit 32 on which alarm messages may 
be displayed and a plant group panel 34 
having one lamp-f or each group of alarms to 
which the monitored alarm conditions may be 
allocated. The visual display unit 32 has an 

50 associated keyboard 33 which may be used 
by the operator to request a display of ail 
alarms present in a particular group (as indi- 
cated by an illuminated alarm lamp of the 
plant group alarm panel 34) or may be used 

55 to request an analysis of the alarms in a 

particular group to determine the major cause 
or causes of alarms in that group. 

'Major' or 'prime' cause alarms are dis- 
played on the visual display unit 32 whilst 

60 subsidiary alarms may be displayed either on 
the visual display unit 32 or (if provided) on a 
separate visual display unit (not shown). 

Periodically^ say every 200 milliseconds, 
the computer 20 scans each input condition 

65 from the interfere circuits 21 to 2n and rec- 



ords those conditions in an individual storage 
word for each condKion in the fast access 
store 40. Programmes for scanning and stor- 
ing input conditions are well known and are 
70 not further described herein. 

It will be apreciated that the interface circu- 
its 21 to 2n need not have individual inputs 
to the computer but may be accessed by way 
of a concentrator (not shown) using suitable 
75 addressing. A typical nuclear power station for 
example may have five thousand monitoring 
devices which may be addressed using, a 1 3- 
bit binary address. 
A separate conputer programme running 
80 synchronously with the scanning programme 
compares the state of each monitored condi- 
tion as stored by its respective word in the 
fast access store with the previous state of 
that condition. 
85 If this programme detects a change in the 
state of the monitored condition (e.g. fresh 
alarm or alarm cleared) it is arranged to record 
the change and time of change in the backing 
store 30. This information may be output to a 
90 printer (not shown). 

When this latter programme detects a 
change of state to the alarm condition It is 
arranged to determine from the data held in 
the backing store 30, which data is user- 
95 determined from the "alarm tree', to which 
of, say, 1 00 plant groups the alarm belongs. 
Unless another alarm already exists in the 
group, the programme causes a respective 
one of 1 00 data words in the fast access store 

1 00 40 to change to indicate alarm presence in 
the group and causes a respective one of the 
alarm lamps on the plant group alarm panel 
34 to be illuminated. 
The activation of an alarm lamp on the 

1 05 group alarm panel 34 is an instruction for the 
operator to check the alarms of that group. 
Each alarm lamp has a respective group num- 
ber and title above the lamp on the group 
alarm panel 34. 

110 The operator may request, by use of the 
keyboard 33, that all alarms present In a 
particular group be displayed on the visual 
display unit 32 or on the separate visual 
display unit (not shown). Alternatively the 

115 operator may request an alarm analysis of the 
particular group. 

If alarm analysis is requested the computer 
20 is arranged to locate the prime cause 
alarm or alarms and display these alarms on 

1 20 the prime cause visual display unit 32. All 
alarms in the group may at the same time be 
individually displayed on the separate visual 
display unit (not shown). 

User defined data (prepared from the alarm 

1 25 tree as previously defined) is held in the 

backing store 30 for each group of the 100 
plant groups. This data represents the lin- 
kages between the alarms in the alarm tree 
and the display title for each alarm. The data 

1 30 also includes linkages and alarm titles for 
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synthetic alarms which are detected by logic 
analysis of the alarms which may be present 
in the group. 

Subsidiary information, such as references 
5 to sections of an instruction manual, may also 
be held in the store. 

When an alarm analysis for a particular 
group is either operator requested or is re- 
quired in response to automatic analysis as 
1 0 hereinafter stated the plant group data for the 
respective group is located from the backing 
store 30 and is transferred to the fast access 
store 40. 

A threading organiser programme now 
1 5 threads the data in the group through appro- 
priate standard sub-routines of the computer 
20. 

The principle subroutines provided are titled 
ANALYSISGROUP, FETCH, LINK, DISPLAY 

20 and GROUP. The functions of each of these 
subroutines is as follows: The subroutine 
ANALYSISGROUP: n calls the data for group 
n from the backing store 30 to the fast access 
store 40 of the computer 20. 

25 FETCH: alarm no. The FETCH subroutine ex- 
amines the respective data word (as defined 
by the data called from the backing store) 
relating to the alarm number to determine 
whether the monitored condition is an alarm. 

30 If the condition is normal (i.e. not an alarm) 
the programme proceeds to the next FETCH 
or if all alarms of this group have been 
examined to the next ANALYSISGROUP. 
If an alarm is present a LINK or DISPLAY 

35 subroutine, dependent on the position of the 
alarm in the alarm tree will be entered. 
LINK: alarm No. The LINK subroutine exam- 
ines the respective data word (as defined by 
the data called from the backing store) relat- 

40 ing to the alarm number to determine whether 
the alarm condition is present. If the higher 
order alarm condition is not present exit from 
the LINK subroutine is to either a further LINK 
or a DISPLAY subroutine. If the alarm condi- 

45 tion is present exit from the LINK subroutine 
will be a subsequent FETCH or to the next 
ANALYSISGROUP. 

GROUP: 'm': list 'p' synthetic alarm no. The 
GROUP subroutine is used to raise a synthetic 

50 alarm if a number 'm' of alarms of a sub- 
group of the main group is present. The alarm 
numbers of each member of the subgroup are 
held in a list 'p' which will have been trans- 
ferred from the backing store by the ANALY- 

55 SISGROUP subroutine. If 'm' or more of the 
alarms in list 'p' are present a DISPLAY 
subroutine is entered to display the synthetic 
alarm defined by the synthetic alarm number 
on the prime cause VDU 32. Exit from the 

60 GROUP subroutine is to a further GROUP 
subroutine or to a DISPLAY subroutine. 

FETCH and LINK subroutines may exit to a 
GROUP subroutine. 
The data for FETCH and LINK subroutines 

65 may include a system parameter to prevent 



the subroutine being entered when the check 
being made is not on the particular system. 

Preparation of the data for each group may 
be more readily understood by consideration 

70 of following examples. 

Referring to Figs. 4 and 5 when assembled 
as shown in Fig. 3 the alarm tree shown is for 
a gas circulator (GC) system of a nuclear 
power station having two reactors (R1 and 

75 R2). 

The lower left hand corner of Fig. 4 in- 
cludes an alarm statement GC motor coolant 
gas outlet temperature hi. The data for this 
alarm would show that GC304A1 is "GC A1 

80 Motor Coolant Gas outlet temperature high" 
and that the alarm may be subsidiary to the 
alarms GC302A1A, GC302A1B, GC302A1C 
and GC303A1 . 

The threading organiser programme inter- 

85 prets this data through the subroutines as:- 

FETCH: GC304A1 
LINK: GC302A1A 

90 

LINK: GC302A1B 

LINK: GC302A1C 

95 LINK: GC303A1 

DISPLAY: GCA1 MOTOR COOLANT GAS 
OUTLET TEMP HIGH. 

100 The threading of the data as shown occurs 
if none of the alarms GC302A1 A, 
GC302A1B, GC302A1C or GC303A1 is pre- 
sent and that GC304A1 is present. This be- 
ing the case GC304A1 is the highest order 

1 05 alarm present and is displayed as the prime 
cause. 

If one of the higher order alarms is present 
the threading of data through the LINK su- 
broutines ceases and the threading organiser 

110 proceeds to thread data relating to the next 
alarm. The higher order alarm will subse- 
quently be analysed in its own right and may 
then be displayed as the prime cause alarm. 
Thus if GC302A1B is also in the alarm con- 

1 1 5 dition and assuming GC303A1 not to be so 
when the threading of data for GC302A1B 
occurs a prime cause display of "GC A1 
MOTOR TEMP HIGH" will be displayed. 
Therefore the operator is led to the cause of 

1 20 the outlet temperature being high rather than 
the effect of the motor temperature being 
high. 

Considering a more complex piece of analy- 
sis for the gas circulator gas cooling water 
1 25 flow as shown in the top left of Fig. 5 the 
threading organiser will thread data for this 
alarm: 

FETCH: GC122A1A 
130 LINK(RI): RP1061 
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UNK{R1): RP1421 
GROUP:2: LIST 1 : GC402 

5 

DISPLAY: GCA1 A GAS COOLER CW FLOW 
LOW, 

List 1 will comprise GC122A1A 

10 

GC122A1B 
GC122A2A 

15 GC122A2B 

Thus if GC122A1A is in the alarm condi- 
tion, RP1061 of reactor 1 (LINK(RI)) (reactor 
cooling water system flow low) and RP1421 

20 of reactor 1 are checked. If neither of the high 
order alarms are present then associated gas 
cooler cooling water flow alarms CG122A1A, 
6C122A1B, CG122A2A, GC122A2B are 
checked and if any two or more of these four 

25 alarms are present (GR0UP:2) the synthetic 
alarm "GC402 GC cooler system cooling wa- 
ter flow low" is displayed on the prime cause 
VDU 32. 

It will be appreciated that separating the " 
30 scanning and analysis of the alarms rather 
than attempting to analyse each alarm as it 
arises, prevents the computer being swamped 
by making major demands on the backing 
store and waiting for the appropriate data to 
35 be transferred. 

All alarms may be displayed to the operator 
but the principle faults are also made readily 
apparent. 

In the absence of a specific request from 

40 the operator for an analysis of a particular 
group the computer 20 may be arranged to 
call for an analysis of each group in turn at 
periodic intervals so that the operator is kept 
informed of the prime causes of all the alarm 

45 conditions present in the system. 

Since the computer is also capable of in- 
putting various conditions such as the open- 
ing or closing of manually operable valves the 
operator may by use of the keyboard 33 

50 request an analysis of a suitable plant state 
under fault conditions. 

The threading organiser may be used to 
thread respective data through the same su- 
broutines to analyse the current plant state 

55 and advise the operator on corrective proce- 
dures. 

Accidents at various power stations have 
brought out the importance of correct preven- 
tative action when alarms initially appear, and 

60 of the importance of the coincidence of two or 
three fault states which of themselves, individ- 
ually, result only in a correct operation of 
standby plant or in a reduction of plant integ- 
rity in a designed and individually acceptable 

65 manner. 



As a particular example consider the re- 
straints on operation in a nuclear plant which 
must be imposed in order to ensure continued 
availability of post-trip cooling, in the event of 

70 major hazards, for example, cable fires or 
coolant circuit breach. 

Typically, four diesel driven fire fighting 
pumps may be provided for a station and 
operation may continue safely with one pump 

75 not available, but an increasing hazard exists 
if a pump outage is prolonged. If two pumps 
are not available, then within a period (say 2 
hours) the station should be shutdown even if 
no fire exists, for reasons of prudence. 

80 A gas cooled reactor typically has 4 boiler 
circuits, each with a gas circulating blower 
driven by a main motor, and by an auxiliary 
pony motor used at shutdown. Post-trip, at 
least one boiler must be available — where 

85 availability is defined by an actual require- 
ment, such as follows:— 
la) The pony motor supply is available. 
1 b) The pony motor control supply is avail- 
able. 

90 Ic) The pony motor control equipment is 
available. 

Id) The pony motor protection has not oper- 
ated 

1e) Associated Gas circulator Bearing Temper- 
95 atures are not excessive, 
and 

1f) An associated circulator inlet guide vane 
operating Fast Motor is available. 
The unavailability of any of the above is 
1 00 indicated by the presence of an accompanying 
alarm. 

Non-alarm operating constraints include:— 
1 g) An associated Pony Motor Mode Selector 
Switch is selected to the Auto Start position; 
105 1h) A 41 5v Gas Circulator Board bus section 
switch is available whenever a Pony Motor/ 
Boiler Unit within the same sub-set is not 
available; 

1 j) one 3.3 kV/41 5V Gas Circulator Transfor- 
110 mer is available in each sub-set; 

1 k) An associated Emergency Feed Header 
Discharge Valve is fully open; 
1 1) an associated Economiser Isolating Valve is 
fully open; 

115 1 m) an associated Start-up Feedwater Regula- 
tor Valve is fully open; 

1n) control equipment providing close action 
of the associated Boiler Stop Valve is avail- 
able; 

120 1o) associated Steam Dump Valve control 
equipment is available; 

1 p) automatic mode of control is selected for 
use on the Steam Dump Valve Control Sys- 
tem. Selection of the manual mode of control 
1 25 is indicated by an alarm; 

1q) the Steam Dump Valve Control Equipment 
is not on test. Equipment on test is indicated 
by an alarm; and 

1r) Steam Dump Pressure Demand is within 
1 30 predetermined limits of the required value for 
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use post-trip. 

Operating restraints involved on boiler pairs 
5 can be expressed on the basis of two separate 
sets of boilers - say set one comprising 
Boilers A and B and set 2 comprising Boilers 
C and D. 

For safety purposes (as an example): 
1 0 2a) not more than one boiler must be unavail- 
able within each set of a reactor at power for 
a period in excess of 1 hour unless orderly 
shutdown of the reactor is initiated; 
2b) The unavailability of one boiler in either 
15 set is undesirable and should not be allowed 
to persist for long periods because if a fire 

* should affect one set the circulator motor 
post-trip run on protection could affect the 

= other set. Operation on three gas circuits 

* 20 should be initiated if the situation has not 

been improved after 4 hours, to reduce the 
probability of an available boiler unit being 
lost as a result of failure to trip a main motor 
breaker; 

25 2c) The integrity of a boiler is attained by the 
use of redundant power supplies etc. Where 
one boilder unit of a set is unavailable and 
there is not a full complement of essential 
supplies available to the other unit or unavail- 

30 ability of changeover units, orderly shutdown 
of the reactor shall be initiated if the situation 
cannot be corrected within a period of 4 
hours; 

2d) The System integrity relies upon the avail- 
35 ability of a fully connected Emergency Feed 
Header. It is undesirable for the header valves 
(either manual or automatic) to be closed. If a 
boiler is unavailable (say in set 2) the auto- 
matic or manual valve associated with the 
40 header section feeding the set 1 boilers 

should not be closed for more than 12 hours; 
or 

2e) The unavailability of one boiler in one set 
coexisting with the unavailability in the other 
45 set of a Gas Circulator Transforrner should not 
be allowed to persist for more than 8 hours. 

The above restraints can be represented by 
a combination of alarm grouping and of truth 

* tables. These in turn can be expressed by 

* 50 means of alarm analysis data and interpreted 

* in the manner already described. The coinci- 
dence of operation of alarms may be used to 
generate appropriate alarms, and display a 
phrase including a time limit. A time delay 

55 subroutine may be included so that an addi- 
tional alarm is displayed after the appropriate 
delay. 

In the case of the above example, "boiler 
not available" alarms (1A, IB, IC, 1D for 

50 each boiler) must be derived by a GROUP 
subroutine involving 1(a) to 1(r) above, initi- 
ated as described If any of 1(a) to 1(r) are in 
the unacceptable state. 

The backing store data to check the accep- 

65 tability of the plant in respect of operating 
restraints 2(a) and 2(b) may be used by the 
thrf^adina oroaniser thus: 



LIST R1R2: Boiler A; Boiler B; Boiler C: Boiler 
70^' 

LIST R1 : Boiler A; Boiler B. 

LIST R2: Boiler C: Boiler D. 

GROUP: 2: LIST R1: SHUTDOWN ALARM 

GROUP: 2: LIST R2: SHUTDOWN ALARM 

75 GROUP: 1: LIST R1R2: ISOLATE ALARM 
FETCH: SHUTDOWN ALARM 
DISPLAY: TWO BOILERS FAILED — SHUT- 
DOWN WITHIN 1 HOUR 
FETCH: ISOLATE ALARM 

QO LINK: SHUTDOWN ALARM 

DISPLAY: BOILER FAILURE — ISOLATE 
WITHIN 4 HOURS 

Thus when alarm analysis is carried out in 
the automatic mode the threading organiser 

35 threads the data through the provided subrou- 
tines first using the GROUP subroutine to 
determine whether both boilers (GROUP: 2) of 
either set (LIST R1 /LIST R2) are unavailable. 
If this is the case the subroutine enters the 

go shutdown alarm in the fast access store 40 
and the backing store 30, 

If any one of the four boilers is unavialable 
(GROUP: 1) an isolate alarm is generated. 
If the shutdown alarm is present the prime 

Qc cause visual display unit 32 will display 
"TWO BOILERS FAILED — SHUTDOWN 
WITHIN 1 HOUR". 

In this case the isolate alarm is treated as a 
subsidiary alarm. If the isolate alarm is pre- 
100 without the shutdown alarm the prime 
cause visual display unit 32 will display "°' 
ILER FAILURE — ISOLATE WITHIN 4 
HOURS". 

The example above illustrates the principle 
105 analysing plant states. The remaining oper- 
ating restraints may be derived in a similar 
manner. 

CLAIMS 

110 ^ • alarm system comprising a com- 
puter, first display means for displaying prime 
cause alarm information, further display 
means for displaying subsidiary alarms which 
are dependent upon at least one associated 

-J 1 5 alarm displayed on the first display means, 
the status of each condition being monitored 
by the computer being presented at an input 
of the computer in digital form and being read 
by the computer at periodic intervals, the 

-J 20 computer having at least one data word for 
each of the conditions being monitored and 
being arranged at each reading of a condition 
to compare the current status of said condi- 
tion with the previous status of the condition 

125 as indicated by its respective stored data to 
determine when a change of status of the 
condition occurs and if the change of status 
indicates that the condition is an alarm to 
determine to which one of n groups of alarms 

1 30 alarm belongs, and to activate a respective 
one of n warning means of the further display 
means associated with the particular group of 
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alarms the computer also being arranged peri- 
odically to consider each alarm with respect 
to any other alarms to determine whether the 
alarm is a prime cause or is an alarm resulting 
5 from another cause and to display each said 
prime cause alarm on the first display means. 

2. An alarm system as claimed in Claim 1 
in which said first display means is a visual 
display unit. 

10 3. An alarm system as claimed in Claim 2 
in which the computer is arranged to cause 
each prime cause alarm to be displayed as a 
phrase or sentence on the visual display unit. 
4. An alarm system as claimed in Claim 3 

1 5 in which the computer is also arranged to 
cause the visual display unit to display a 
reference to further information which is avail- 
able for at least some of the displayed prime 
cause alarms. 

20 5. An alarm system as claimed in any 
preceding claim in which the computer is also 
arranged periodically to consider predeter- 
mined groupings of the conditions being 
monitored and, if more than a specified num- 

25 ber of one of said predetermined groupings 
are in an alarm state without a higher order 
alarm relating to a monitored condition being 
present, to cause the first display means to 
display a prime cause alarm determined from 

30 said grouping. 

6. An alarm system as claimed in any 
preceding claim in which the computer is also 
arranged periodically to consider the opera- 
tional capability of parts of the apparatus 

35 being monitored, to determine the acceptabil- 
ity of continued operation of the apparatus if 
some parts of the apparatus are not available 
for use and, if continued operation of the 
apparatus is unacceptable to cause said first 

40 display means to display an appropriate mes- 
sage. 

7. An alarm system as claimed in Claim 
6 in which the computer is also arranged to 
determine, in dependence on the parts of the 

45 apparatus which are not available for use and 
by consideration of the probability of further 
parts of the apparatus becoming unavailable, 
the probability of continued operation of the 
apparatus becoming unacceptable within a 

50 calculated period and to cause the first display 
means to display a warning message includ- 
ing said caculated period. 

8. An alarm system as claimed in any 
preceding claim including a keyboard for use 

55 by an operator to request the computer to 
display on the first display means the titles of 
all of the alarm conditions present in one of 
said groups of alarms. 

9. An alarm system as claimed in Claim 8 
60 in which the computer is also arranged to 

respond to a keyboard request for an analysis 
of one of said groups of alarms. 

10. An alarm system substantially as here- 
inbefore described with reference to the ac- 

65 companying drawings. 
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